SECURITY: iframe navigating top-level content - user gesture should be required

Slimjet bug reports
Post Reply
asdasdasd
Posts: 1
Joined: Fri Sep 07, 2018 4:07 pm

SECURITY: iframe navigating top-level content - user gesture should be required

Post by asdasdasd » Fri Sep 07, 2018 4:36 pm

security related bug to be checked please:

In general this deals with one of scam pages' techniques where IFRAME contained code would try to command the browser to change the top level content without user knowledge.



original info from CHROMIUM.ORG blog https://blog.chromium.org/2018/06/chrom ... creen.html:
"Beginning in Chrome 68, content embedded in an iframe will require a user gesture to navigate the top-level browsing context to a different origin. Similar to pop-up blocking, when this protection triggers users will see Chrome UI giving them the option to allow the redirect the continue."
You can check this behavior simulated in the demo, originally by Chromium.org blog referenced one: https://ndossougbe.github.io/web-sandbo ... -redirect/.

I have checked this through Slimjet (Version 20.0.2.0 (based on Chromium 68.0.3440.75) (Official Build) (32-bit); running in Windows 8.1, 8GB RAM, on Intel platform)


The navigation was cancelled indeed. However, Slimjet UI did not show a request to choose between cancellation and continuation. When I have right-clicked any of their 3 demo iframes, and chose to reload the iframe, the iframe related navigation continued, again without any UI dialog box = Slimjet continued as if I would explicitly choose to continue)

Maybe something on my side, could anyone else check on own comp and (un)confirm this behavior?


Thx, Meno

CrockPot
Posts: 39
Joined: Sat Oct 28, 2017 7:26 am

Re: SECURITY: iframe navigating top-level content - user gesture should be required

Post by CrockPot » Sun Sep 09, 2018 9:33 am

"user gesture" does not necessarily means a pop up informing you and asking you what to do.When there is a block iframe(s) like the ones from the test page look at your address bar next to the bookmark star there will be new icon there,click on it and will give you options.

Post Reply